Django drf：认证及组件、token、局部钩子源码分析

本文目录：

　　1.认证简介：

　　　　只有认证通过的用户才能访问指定的url地址，比如：查询课程信息，需要登录之后才能查看，没有登录则不能查看。这时候需要用到认证组件

　　2.局部使用

　　　　models层

class User(models.Model):
    name = models.CharField(max_length=32)
    password = models.CharField(max_length=32)


class UserToken(models.Model):
    token = models.CharField(max_length=64)
    user = models.OneToOneField(to='User')

　　　　新建认证类（验证通过return两个参数）

from rest_framework.authentication import BaseAuthentication

class Authlogin(BaseAuthentication):
    def authenticate(self, request):
        token = request.GET.get('token')
        res = models.UserToken.objects.filter(token=token).first()
        if res:
            # 说明这个人登录了
            # return None
            return res.user, token
        else:
            # 说明没有登录
            raise NotAuthenticated("您没有登录")

　　　　views层

def get_token(name):
    m = hashlib.md5(name.encode("utf-8"))
    print(m.hexdigest())
    res = m.hexdigest()
    return res


class Login(APIView):
    #authentication_classes = []
    def post(self, request):
        response = {'status': 100, 'msg': None}
        # 把用户名和密码取到
        name = request.data.get('name')
        pwd = request.data.get('password')
        print(name, pwd)
        # 取出数据库的用户数据
        user = models.User.objects.filter(name=name, password=pwd).first()
        print(user)
        if user:
            response['msg'] = '登录成功！'
            # 随机字符串可以是用户名+当前同时生成md5
            # uuid
            token = get_token(name)

            # user = user 查询条件 defaults={'token'：token}
            models.UserToken.objects.update_or_create(user=user, defaults={'token': token})
            response['token'] = token
        else:
            # response['status']后面是等于号不是冒号
            response['status'] = 101
            print(response['status'])
            response['msg'] = '用户名或密码错误'
        return Response(response)

def get_token(id,salt='123'):
    import hashlib
    md=hashlib.md5()
    md.update(bytes(str(id),encoding='utf-8'))
    md.update(bytes(salt,encoding='utf-8'))

    return md.hexdigest()+'|'+str(id)

def check_token(token,salt='123'):
    ll=token.split('|')
    import hashlib
    md=hashlib.md5()
    md.update(bytes(ll[-1],encoding='utf-8'))
    md.update(bytes(salt,encoding='utf-8'))
    if ll[0]==md.hexdigest():
        return True
    else:
        return False

class TokenAuth():
    def authenticate(self, request):
        token = request.GET.get('token')
        success=check_token(token)
        if success:
            return
        else:
            raise AuthenticationFailed('认证失败')
    def authenticate_header(self,request):
        pass
class Login(APIView):
    def post(self,reuquest):
        back_msg={'status':1001,'msg':None}
        try:
            name=reuquest.data.get('name')
            pwd=reuquest.data.get('pwd')
            user=models.User.objects.filter(username=name,password=pwd).first()
            if user:
                token=get_token(user.pk)
                # models.UserToken.objects.update_or_create(user=user,defaults={'token':token})
                back_msg['status']='1000'
                back_msg['msg']='登录成功'
                back_msg['token']=token
            else:
                back_msg['msg'] = '用户名或密码错误'
        except Exception as e:
            back_msg['msg']=str(e)
        return Response(back_msg)
from rest_framework.authentication import BaseAuthentication
class TokenAuth():
    def authenticate(self, request):
        token = request.GET.get('token')
        token_obj = models.UserToken.objects.filter(token=token).first()
        if token_obj:
            return
        else:
            raise AuthenticationFailed('认证失败')
    def authenticate_header(self,request):
        pass

class Course(APIView):
    authentication_classes = [TokenAuth, ]

    def get(self, request):
        return HttpResponse('get')

    def post(self, request):
        return HttpResponse('post')

不存数据库的token验证